[Fleet] Disable standalone installation for Fleet Server policies

[Copilot]

Users could access standalone installation mode for Fleet Server policies from the Installed Integrations tab, despite this being operationally invalid. The Agent Policy tab correctly prevented this.

Changes

• AgentEnrollmentFlyout: Disable standalone tab when isFleetServerPolicySelected is true
• Tests: Added coverage for Fleet Server policy standalone tab behavior

Implementation

<EuiTab
  data-test-subj="standaloneTab"
  disabled={!authz.fleet.readAgentPolicies || isFleetServerPolicySelected}
>
  Run standalone
</EuiTab>

The fix reuses existing Fleet Server detection logic already present in the component. Standalone mode remains available for regular policies.

Fixes

https://github.com/elastic/kibana/issues/[issue-number]

Warning

Firewall rules blocked me from connecting to one or more addresses (expand for details)

I tried to connect to the following addresses, but was blocked by firewall rules:

• ci-stats.kibana.dev
  • Triggering command: /home/REDACTED/.nvm/versions/node/v22.17.1/bin/node --no-experimental-require-module scripts/kbn bootstrap --quiet (dns block)
  • Triggering command: /home/REDACTED/.nvm/versions/node/v22.17.1/bin/node --no-experimental-require-module scripts/kbn clean (dns block)
  • Triggering command: /home/REDACTED/.nvm/versions/node/v22.17.1/bin/node --no-experimental-require-module scripts/kbn bootstrap --force-install (dns block)
• download.cypress.io
• googlechromelabs.github.io
  • Triggering command: /home/REDACTED/.nvm/versions/node/v22.17.1/bin/node install.js (dns block)
• iojs.org
  • Triggering command: curl -q --fail --compressed -L -s REDACTED -o - (dns block)

If you need me to access, download, or install something from one of these locations, you can either:

• Configure Actions setup steps to set up my environment, which run before the firewall is enabled
• Add the appropriate URLs or hosts to the custom allowlist in this repository's Copilot coding agent settings (admins only)

Original prompt

---

This section details on the original issue you should resolve

<issue_title>[Fleet]: User is able to open Standalone installation flyout for Agent policy with Fleet Server integration.</issue_title>
<issue_description>Kibana version:

VERSION: 9.2.0-SNAPSHOT
BUILD: 91136
COMMIT: 8d4b0956586284c35db97de2baea49b58476ee2a

Preconditions:

1. 9.2.0-SNAPSHOT Kibana cloud environment should be available.

Steps to reproduce:

1. Add Fleet Server integration to any Agent policy.
2. Observe user is not able to open Standalone mode of installation for Fleet Server agent policy under Agents/Agent policy tab.
3. Now navigate to Installed integrations tab.
4. Click Add agent for Agent policy with Fleet Server integration.
5. Observe user is able to open Standalone installation flyout for Agent policy with Fleet Server integration.

Expected behavior:
User should not be able to open Standalone installation flyout for Agent policy with Fleet Server integration.

Screen Capture:

https://github.com/user-attachments/assets/b36a2f9d-2a15-4342-bbae-c01332364c6b</issue_description>

Comments on the Issue (you are @copilot in this section)

@elasticmachine Pinging @elastic/fleet (Team:Fleet) @amolnater-qasource @muskangulati-qasource Please review. @amolnater-qasource **Suggestion to address the issue:** **Version:** Copilot- GPT-4.1

Root Cause:

• The UI logic that determines whether to show/enable the Standalone installation flyout for a given Agent policy is not correctly checking if the policy includes a Fleet Server integration.
• The check seems to be present in the Agents/Agent policy tab but missing in the Installed integrations tab.

Steps to Fix:

1. Locate Policy Restriction Logic:

   • Identify the code that controls the visibility/enabling of the Standalone installation flyout button in both the Agent policy and Installed integrations tabs.
   • Typically, this logic will exist in components like:
     • x-pack/plugins/fleet/public/sections/agent_policy/
     • x-pack/plugins/fleet/public/sections/agent_policy/components/
     • x-pack/plugins/fleet/public/sections/agents/components/
     • x-pack/plugins/fleet/public/applications/fleet/sections/installed_integrations/

2. Find the Standalone Installation Trigger:

   • The flyout is usually triggered by an "Add agent" button. Locate where this button is rendered and what conditions are used to enable/disable it.
   • Example files:
     • x-pack/plugins/fleet/public/sections/agent_policy/components/agent_policy_add_agent_button.tsx
     • x-pack/plugins/fleet/public/sections/agents/components/add_agent_flyout.tsx
     • x-pack/plugins/fleet/public/sections/installed_integrations/view/agent_policy_selection_table.tsx

3. Unify the Check:

   • Ensure that before rendering or enabling the Standalone installation flyout, you check if the selected Agent policy contains a Fleet Server integration.
   • The check is often like:

     const hasFleetServer = agentPolicy?.package_policies?.some(
       (pkg) => pkg.package?.name === 'fleet_server'
     );

   • If hasFleetServer is true, disable or hide the Standalone installation option.

4. Update UI in Installed Integrations Tab:

   • In the Installed integrations tab, locate where the "Add agent" button or flyout is triggered.
   • Apply the same check as in the Agent policy tab to prevent the flyout from opening if the policy has Fleet Server.

Key Filenames to Modify:

• x-pack/plugins/fleet/public/sections/installed_integrations/view/agent_policy_selection_table.tsx
  (or similar, depending on where the "Add agent" button is handled for installed integrations)
• x-pack/plugins/fleet/public/sections/agent_policy/components/agent_policy_add_agent_button.tsx
  (ensure logic is consistent)

@muskangulati-qasource Secondary review is Done for this ticket!

• Fixes [Fleet]: User is able to open Standalone installation flyout for Agent policy with Fleet Server integration. #236875

---

💬 We'd love your input! Share your thoughts on Copilot coding agent in our 2 minute survey.

[jen-huang]

buildkite test this

[elasticmachine]

💛 Build succeeded, but was flaky

• Buildkite Build
• Commit: fdb186a

Failed CI Steps

• FTR Configs #21

Test Failures

• [job] [logs] FTR Configs #21 / InfraOps App feature controls infrastructure security global infrastructure all privileges infrastructure landing page with data shows Wafflemap

Metrics [docs]

Async chunks

Total size of all lazy-loaded chunks that will be downloaded as the user navigates the app

id	before	after	diff
fleet	2.1MB	2.1MB	+3.0B

History

• 💔 Build #357875 failed fad38a7

cc @jen-huang @copilot